Skip to content

Commit

Permalink
Fix critical permissions error.
Browse files Browse the repository at this point in the history
Only logged-in users can administer. This was an interaction between
paper managers/administrators and author-view capabilities. It may
have been introduced recently, with the rights rewrite. Reported
by Colin Dixon.
  • Loading branch information
kohler committed Jan 21, 2014
1 parent be7c271 commit 1e10f49
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions src/contact.php
Expand Up @@ -666,9 +666,10 @@ private function rights($prow, $forceShow = null) {
// check first whether administration is allowed
if (@$ci->rights_version != $this->rights_version_) {
$ci->allow_administer = false;
if (!($prow->managerContactId
&& $prow->managerContactId != $this->contactId
&& $ci->conflict_type)
if ($this->contactId > 0
&& !($prow->managerContactId
&& $prow->managerContactId != $this->contactId
&& $ci->conflict_type)
&& ($this->privChair
|| $prow->managerContactId == $this->contactId))
$ci->allow_administer = true;
Expand Down

5 comments on commit 1e10f49

@colin-scott
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Colin Scott, not Colin Dixon, although Colin Dixon is one of my friends ;-)

@colin-scott
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(Thanks Eddie!)

@kohler
Copy link
Owner Author

@kohler kohler commented on 1e10f49 Jan 21, 2014 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kohler
Copy link
Owner Author

@kohler kohler commented on 1e10f49 Jan 21, 2014 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@colin-scott
Copy link

@colin-scott colin-scott commented on 1e10f49 Jan 21, 2014 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.